N\u00eb paketat e hapura IWD (Intel inet Wireless Daemon) dhe wpa_supplicant, t\u00eb p\u00ebrdorura p\u00ebr t\u00eb organizuar lidhjen e sistemeve Linux klient n\u00eb nj\u00eb rrjet pa tela, jan\u00eb zbuluar dob\u00ebsi q\u00eb \u00e7ojn\u00eb n\u00eb anashkalimin e mekanizmave t\u00eb autentikimit: <\/p>\n
Dob\u00ebsia shkaktohet nga mungesa e verifikimit t\u00eb duhur t\u00eb rendit t\u00eb kalimit t\u00eb t\u00eb gjith\u00eb hapave gjat\u00eb negociimit me 4 faza t\u00eb kanalit t\u00eb komunikimit, i cili p\u00ebrdoret gjat\u00eb lidhjes s\u00eb par\u00eb me nj\u00eb rrjet pa tela t\u00eb mbrojtur. P\u00ebr shkak se IWD pranon mesazhe p\u00ebr \u00e7do faz\u00eb t\u00eb negociimit t\u00eb lidhjes pa verifikuar n\u00ebse faza e m\u00ebparshme \u00ebsht\u00eb p\u00ebrfunduar, nj\u00eb sulmues mund, duke anashkaluar d\u00ebrgimin e mesazhit t\u00eb faz\u00ebs s\u00eb dyt\u00eb, t\u00eb d\u00ebrgoj\u00eb menj\u00ebher\u00eb mesazhin e faz\u00ebs s\u00eb kat\u00ebrt dhe t\u00eb fitoj\u00eb qasje n\u00eb rrjet, duke kap\u00ebrcyer faz\u00ebn n\u00eb t\u00eb cil\u00ebn kryhet verifikimi i autentikimit. <\/p>\n
Nj\u00ebkoh\u00ebsisht, IWD p\u00ebrpiqet t\u00eb verifikoj\u00eb kodin MIC (Message Integrity Code) p\u00ebr mesazhin e marr\u00eb t\u00eb faz\u00ebs s\u00eb kat\u00ebrt. Meqen\u00ebse mesazhi i faz\u00ebs s\u00eb dyt\u00eb me parametrat e autentikimit nuk \u00ebsht\u00eb marr\u00eb, gjat\u00eb p\u00ebrpunimit t\u00eb mesazhit t\u00eb faz\u00ebs s\u00eb kat\u00ebrt \u00e7el\u00ebsi PTK (Pairwise Transient Key) vendoset n\u00eb vler\u00eb zero. Si rrjedhoj\u00eb, sulmuesi mund ta llogaris\u00eb MIC duke p\u00ebrdorur nj\u00eb PTK zero, dhe ky kod verifikimi do t\u00eb pranohet nga IWD si i sakt\u00eb. Pas p\u00ebrfundimit t\u00eb nj\u00eb negociimi t\u00eb till\u00eb t\u00eb paplot\u00eb t\u00eb lidhjes, sulmuesi do t\u00eb marr\u00eb qasje t\u00eb plot\u00eb n\u00eb rrjetin pa tela, pasi pika e aksesit do t\u00eb pranoj\u00eb kornizat q\u00eb ai d\u00ebrgon, t\u00eb enkriptuara me \u00e7el\u00ebsin zero PTK. <\/p>\n
P\u00ebr shkak t\u00eb nj\u00eb mang\u00ebsie n\u00eb zbatimin e protokollit PEAP (Protected Extensible Authentication Protocol), nj\u00eb sulmues mund t\u00eb anashkaloj\u00eb faz\u00ebn e dyt\u00eb t\u00eb autentikimit gjat\u00eb lidhjes s\u00eb nj\u00eb pajisjeje p\u00ebrdoruesi t\u00eb konfiguruar gabim. Anashkalimi i faz\u00ebs s\u00eb dyt\u00eb t\u00eb autentikimit i lejon sulmuesit t\u00eb krijoj\u00eb nj\u00eb klon t\u00eb rrem\u00eb t\u00eb nj\u00eb rrjeti Wi\u2011Fi t\u00eb besuar dhe t\u00eb b\u00ebj\u00eb q\u00eb p\u00ebrdoruesi t\u00eb lidhet me nj\u00eb rrjet fals pa verifikim fjal\u00ebkalimi. <\/p>\n
Q\u00eb sulmi t\u00eb realizohet me sukses, n\u00eb an\u00ebn e p\u00ebrdoruesit te wpa_supplicant duhet t\u00eb jet\u00eb \u00e7aktivizuar verifikimi i certifikat\u00ebs TLS<\/a> serverit, nd\u00ebrsa sulmuesi duhet t\u00eb dij\u00eb identifikuesin e rrjetit pa tela (SSID, Service Set Identifier). Gjithashtu, sulmuesi duhet t\u00eb jet\u00eb brenda rrezes s\u00eb adaptorit pa tela t\u00eb viktim\u00ebs, por jasht\u00eb rrezes s\u00eb pik\u00ebs s\u00eb aksesit t\u00eb rrjetit pa tela q\u00eb klonohet. Sulmi \u00ebsht\u00eb i mundur n\u00eb rrjete me WPA2-Enterprise ose WPA3-Enterprise, ku p\u00ebrdoret protokolli PEAP. <\/p>\n Zhvilluesit e wpa_supplicant deklaruan se nuk e konsiderojn\u00eb problemin si cenueshm\u00ebri, pasi ai shfaqet vet\u00ebm n\u00eb rrjete pa tela t\u00eb konfiguruara gabim, ku autentikimi EAP p\u00ebrdoret s\u00eb bashku me protokollin PEAP (EAP-TTLS) pa verifikim t\u00eb certifikat\u00ebs TLS server\u00eb<\/a>. Konfigurimet pa verifikim certifikate nuk kan\u00eb mbrojtje ndaj sulmeve aktive. Ata q\u00eb e zbuluan cenueshm\u00ebrin\u00eb pohojn\u00eb se konfigurime t\u00eb tilla t\u00eb pasakta jan\u00eb tipike dhe t\u00eb p\u00ebrhapura gjer\u00ebsisht, gj\u00eb q\u00eb v\u00eb n\u00eb rrezik shum\u00eb pajisje konsumatori me baz\u00eb Linux, Android dhe Chrome OS, ku p\u00ebrdoret wpa_supplicant. <\/p>\n P\u00ebr t\u00eb bllokuar problemin n\u00eb wpa_supplicant, \u00ebsht\u00eb publikuar nj\u00eb patch q\u00eb shton nj\u00eb regjim me kalim t\u00eb detyruesh\u00ebm t\u00eb faz\u00ebs s\u00eb dyt\u00eb t\u00eb autentikimit, p\u00ebrve\u00e7 verifikimit t\u00eb certifikat\u00ebs TLS. Sipas zhvilluesve, ndryshimi i propozuar \u00ebsht\u00eb vet\u00ebm nj\u00eb zgjidhje e p\u00ebrkohshme, q\u00eb e v\u00ebshtir\u00ebson kryerjen e sulmeve kur p\u00ebrdoret autentikim manual dhe \u00ebsht\u00eb i padobish\u00ebm kur p\u00ebrdoren opsione t\u00eb tilla si EAP-GTC. P\u00ebr nj\u00eb zgjidhje reale t\u00eb problemit, administrator\u00ebt e rrjetit duhet t\u2019i sjellin konfigurimet n\u00eb gjendjen e duhur, dometh\u00ebn\u00eb t\u00eb konfigurojn\u00eb zinxhirin e besimit p\u00ebr verifikimin e certifikat\u00ebs s\u00eb serverit me ndihm\u00ebn e parametrit ca_cert. <\/ul>\n